CISCO-802-TAP-MIB

All MIBs › CISCO-802-TAP-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2004-03-11

Category: Cisco Devices, VPN and Security

Description: Manages IEEE 802 media lawful intercept tap configuration on Cisco devices.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-802-TAP-MIB?

CISCO-802-TAP-MIB is a Cisco-specific MIB supporting lawful-intercept configuration for IEEE 802 (Layer 2 Ethernet) traffic streams, used alongside CISCO-TAP2-MIB, which supplies the common stream information shared across intercept types. It exposes configuration data defining intercept filters — matching criteria such as destination/source MAC address, EtherType (Ethernet PID), and LLC SAP values — for the streams to be tapped, plus stream status and packet-encoding controls. This MIB is primarily a security/compliance configuration module rather than a hardware/software health-status MIB: it does not report uptime, temperature, CPU, or memory, but it does expose per-stream administrative status (c802tapStreamStatus) indicating whether a given intercept filter is active. It has an explicit dependency on CISCO-TAP2-MIB, which supplies the shared cTap2Stream table that this MIB's entries reference and extend. It would be deployed on Cisco routers/switches performing lawful-intercept functions for law-enforcement compliance in service-provider or enterprise networks, where the CISCO-802-TAP-MIB MIB defines the Layer 2 filter criteria used to provision each tap.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-802-TAP-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco router/switch performing IEEE 802 (Layer 2) lawful intercept

Monitoring Examples

A compliance system creates a c802tapStreamEntry specifying c802tapStreamInterface, c802tapStreamDestinationAddress and c802tapStreamSourceAddress, plus c802tapStreamEthernetPid or LLC SAP filters, then sets c802tapStreamStatus to activate the intercept; polling that status object confirms the tap remains active. c802tapStreamCapabilities can be checked beforehand to confirm the device supports the required 802 filtering capability before attempting to provision a tap.

What Can Be Monitored

per-stream intercept filter status (active/inactive)
configured destination/source MAC address filters
EtherType (Ethernet PID) filter
LLC SAP filter values
device 802-tap capability support

Imported Objects

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From CISCO-TAP2-MIB

cTap2MediationContentId	OBJECT-TYPE
cTap2StreamIndex	OBJECT-TYPE

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Integer32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

MacAddress
RowStatus

OIDs

OID symbolic	OID numeric	Type	Access	Description
cisco802TapMIB	1.3.6.1.4.1.9.9.395			This module manages Cisco's intercept feature for 802 (layer 2) streams. This MIB is used along with CISCO-TAP2-MIB to intercept 802 traffic. CISCO-TAP2-MIB along with specific filter MIBs like this MIB replace CISCO-TAP-MIB. To create an 802 intercept, an entry c802tapStreamEntry is created which contains the filter details. An entry cTap2StreamEntry of CISCO-TAP2-MIB is created which is the common stream information for all kinds of intercepts and type of the specific stream is set to mac in this entry.
cisco802TapMIBNotifs	1.3.6.1.4.1.9.9.395.0
cisco802TapMIBObjects	1.3.6.1.4.1.9.9.395.1
c802tapStreamEncodePacket	1.3.6.1.4.1.9.9.395.1.1
BIT c802tapStreamCapabilities	1.3.6.1.4.1.9.9.395.1.1.1	Bits	read-only	This object displays what types of intercept streams can be configured on this type of device. This may be dependent on hardware capabilities, software capabilities. The following fields may be supported: tapEnable: set if table entries with cTap2StreamInterceptEnable set to 'false' are used to pre-screen packets for intercept; otherwise these entries are ignored. interface: SNMP ifIndex Value may be used to select interception of all data crossing an interface or set of interfaces. dstMacAddr: Destination MAC Address may be used to select traffic to be intercepted. srcMacAddr: Source MAC Address may be used to select traffic to be intercepted. ethernetPid: Ethernet Protocol Identifier may be used to select traffic to be intercepted. dstLlcSap: IEEE 802.2 Destination SAP may be used to select traffic to be intercepted. srcLlcSap: IEEE 802.2 Source SAP may be used to select traffic to be intercepted.
c802tapStreamTable	1.3.6.1.4.1.9.9.395.1.1.2		not-accessible	The Intercept Stream 802 Table lists the IEEE 802 data streams to be intercepted. The same data stream may be required by multiple taps, and one might assume that often the intercepted stream is a small subset of the traffic that could be intercepted. This essentially provides options for packet selection, only some of which might be used. For example, if all traffic to or from a given interface is to be intercepted, one would configure an entry which lists the interface, and wild-card everything else. If all traffic to or from a given MAC Address is to be intercepted, one would configure two such entries listing the MAC Address as source and destination respectively, and wild-card everything else. The first index indicates which Mediation Device the intercepted traffic will be diverted to. The second index permits multiple classifiers to be used together, such as having a MAC address as source or destination. Entries are added to this table via c802tapStreamStatus in accordance with the RowStatus convention.
c802tapStreamEntry	1.3.6.1.4.1.9.9.395.1.1.2.1		not-accessible	A stream entry indicates a single data stream to be intercepted to a Mediation Device. Many selected data streams may go to the same application interface, and many application interfaces are supported.
BIT c802tapStreamFields	1.3.6.1.4.1.9.9.395.1.1.2.1.1	Bits	read-create	This object displays what attributes must be tested to identify traffic which requires interception. The packet matches if all flagged fields match. interface: indicates that traffic on the stated interface is to be intercepted dstMacAddress: indicates that traffic destined to a given address should be intercepted srcMacAddress: indicates that traffic sourced from a given address should be intercepted ethernetPid: indicates that traffic with a stated Ethernet Protocol Identifier should be intercepted dstLlcSap: indicates that traffic with an certain 802.2 LLC Destination SAP should be intercepted srcLlcSap: indicates that traffic with an certain 802.2 LLC Source SAP should be intercepted At least one of the bits has to be set in order to activate an entry. If the bit is not on, the corresponding MIB object value has no effect, and need not be specified when creating the entry.
I32 c802tapStreamInterface	1.3.6.1.4.1.9.9.395.1.1.2.1.2	Integer32	read-create	The ifIndex value of the interface over which traffic to be intercepted is received or transmitted. The interface may be physical or virtual. If this is the only parameter specified, and it is other than -1 or 0, all traffic on the selected interface will be chosen. If the value is zero, matching traffic may be received or transmitted on any interface. Additional selection parameters must be selected to limit the scope of traffic intercepted. This is most useful on non-routing platforms or on intercepts placed elsewhere than a subscriber interface. If the value is -1, one or both of c802tapStreamDestinationAddress and c802tapStreamSourceAddress must be specified. Matching traffic on the interface pointed to by the dot1dTpFdbPort values associated with those values is intercepted, whichever is specified. If dot1dTpFdbPort changes, either by operator action or by protocol events, the interface will change with it. This is primarily intended for use on subscriber interfaces and other places where routing is guaranteed to be symmetrical. In both of these cases, it is possible to have the same packet selected for intersection on both its ingress and egress interface. Nonetheless, only one instance of the packet is sent to the Mediation Device. This value must be set when creating a stream entry, either to select an interface, to select all interfaces, or to select the interface that bridging learns. Some platforms may not implement the entire range of options.
MAC c802tapStreamDestinationAddress	1.3.6.1.4.1.9.9.395.1.1.2.1.3	MacAddress	read-create	The Destination address used in packet selection.
MAC c802tapStreamSourceAddress	1.3.6.1.4.1.9.9.395.1.1.2.1.4	MacAddress	read-create	The Source Address used in packet selection.
U32 c802tapStreamEthernetPid	1.3.6.1.4.1.9.9.395.1.1.2.1.5	Unsigned32	read-create	The value of the Ethernet Protocol Identifier, which may be found on Ethernet traffic or IEEE 802.2 SNAP traffic.
U32 c802tapStreamDestinationLlcSap	1.3.6.1.4.1.9.9.395.1.1.2.1.6	Unsigned32	read-create	The value of the IEEE 802.2 Destination SAP.
U32 c802tapStreamSourceLlcSap	1.3.6.1.4.1.9.9.395.1.1.2.1.7	Unsigned32	read-create	The value of the IEEE 802.2 Source SAP.
ROW c802tapStreamStatus	1.3.6.1.4.1.9.9.395.1.1.2.1.8	RowStatus	read-create	The status of this conceptual row. This object manages creation, modification, and deletion of rows in this table. When any rows must be changed, c802tapStreamStatus must be first set to 'notInService'.
cisco802TapMIBConform	1.3.6.1.4.1.9.9.395.2
cisco802TapMIBCompliances	1.3.6.1.4.1.9.9.395.2.1
cisco802TapMIBCompliance	1.3.6.1.4.1.9.9.395.2.1.1			The compliance statement for entities which implement the Cisco Intercept MIB for 802 streams.
cisco802TapMIBGroups	1.3.6.1.4.1.9.9.395.2.2
cisco802TapStreamGroup	1.3.6.1.4.1.9.9.395.2.2.1			These objects are necessary for a description of IEEE 802 packets to select for interception.

RFC description

Manages Cisco's 802 (layer 2) intercept feature for lawful intercept operations on MAC-based streams with content mediation support.

Start monitoring Cisco routers/switches (IEEE 802 Layer 2 lawful intercept) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-802-TAP-MIB

What Is CISCO-802-TAP-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description